Access Denied Importing DeviceType

[craized]

Hi,

I've experienced problems hitting the import page for Device Types since NetBox upgrade (I don't think I've tried since 3.3, maybe even earlier).

What works:

• Adding Device Types via the UI and API
• UI button next to Device Types for 'Import' is visible

What doesn't work:
Accessing /dcim/device-types/import/ throws an 'Access Denied' page with the message "You do not have permission to access this page."

I've tested that disabling 'dcim.add_devicetype' permissions group makes the import and create buttons in the UI go away, and re-enabling makes both them come back.

I imagine this is some problem local to me since I haven't seen any other complaints about similar behavior (or I've failed searching.)

Any help is greatly appreciated
Thanks!

Current Netbox version: v3.3.1

[candlerb]

In the source code:

class DeviceTypeImportView(generic.ObjectImportView):
    additional_permissions = [
        'dcim.add_devicetype',
        'dcim.add_consoleporttemplate',
        'dcim.add_consoleserverporttemplate',
        'dcim.add_powerporttemplate',
        'dcim.add_poweroutlettemplate',
        'dcim.add_interfacetemplate',
        'dcim.add_frontporttemplate',
        'dcim.add_rearporttemplate',
        'dcim.add_modulebaytemplate',
        'dcim.add_devicebaytemplate',
        'dcim.add_inventoryitemtemplate',
    ]

It looks like you need all those permissions to import a device type.

[craized]

Oh great, I hadn't found the right spot to look for permissions reqs.

I've noticed that when updating NetBox and new permissions are introduced
they haven't always been added to the NetBox database. Chasing permissions
that should exist but don't has been a tedious exercise a few times now
(hopefully a thing of the past?)

Thank you very much, I'll report back in a couple hours when I've verified
this is the fix.

[craized]

My admin interface was completely missing permission for DCIM->ModuleBayTemplate and DCIM->InventoryItemTemplate.

Successfully accessed the page after I added the new permissions and assigned them to proper groups.

[mtinberg]

Yeah, checking the permissions after version upgrades is tedious but I don't see any other way to handle it, the local Netbox admin should always be in the loop for permissions decisions, I don't think the Netbox database migrations should try and figure out what roles and groups your deployment may have created and then guess about which permissions should be added to what groups, that seems like the road to unforeseen consequences. — Mark Tinberg ***@***.***> Division of Information Technology-Network Services University of Wisconsin-Madison

…

________________________________ From: Tomoc ***@***.***> Sent: Wednesday, October 12, 2022 3:51 PM To: netbox-community/netbox ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [netbox-community/netbox] Access Denied Importing DeviceType (Discussion #10632) Oh great, I hadn't found the right spot to look for permissions reqs. I've noticed that when updating NetBox and new permissions are introduced they haven't always been added to the NetBox database. Chasing permissions that should exist but don't has been a tedious exercise a few times now (hopefully a thing of the past?) Thank you very much, I'll report back in a couple hours when I've verified this is the fix. — Reply to this email directly, view it on GitHub<#10632 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAS7UMY4LWBXM7XGCUB5VV3WC4QGLANCNFSM6AAAAAARDOKNCE>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[craized]

Thanks for the thought, Mark. I'm not referring to automatically adding permissions to existing users, merely making sure the permissions that would exist on fresh install. For instance, by default when you install NetBox, the Device model related permissions such as dcim.add_device exist. After major upgrades, sometimes NetBox models are added/extended and thus require additional related permissions that would be automatically included if NetBox was installed cleanly. A recent example would be the addition of Module Bays. In order to gain access to module bays for my existing, upgraded install, I actually had to go into the admin interfaces, click ADD PERMISSION and add the permissions associated with the new model-- dcim.add_modulebay, for instance.

I don't think this is the right thread to ask for any changes to that behavior, rather making sure my experience is comprehensible.